{"id":216,"date":"2016-11-23T17:46:31","date_gmt":"2016-11-23T17:46:31","guid":{"rendered":"https:\/\/blog.mozilla.org\/webrtc\/?p=216"},"modified":"2019-06-05T16:32:11","modified_gmt":"2019-06-05T16:32:11","slug":"share-browser-windows-entire-screen-sites-trust","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/webrtc\/share-browser-windows-entire-screen-sites-trust\/","title":{"rendered":"Share browser windows and entire screen only with sites you trust."},"content":{"rendered":"

Screen-sharing<\/strong> is a powerful new web feature that lets you share what’s on your computer screen with a web site. This can be extremely useful. Imagine co-browsing with a friend, or having a service technician remotely diagnose a problem on your computer. But at the same time, it carries significant security and privacy risks.<\/p>\n

Certain windows are riskier to share than others. Firefox will warn you not to share browser windows, or even your entire screen when a browser window is present on it, unless you trust the web site<\/strong>. The reasons for this are technical, but boil down to this:<\/p>\n

When sharing a regular window, a web site may passively record what you’re doing, which is bad enough: It can catch glimpses of things you didn’t intend to share, say if you scroll quickly through a document.<\/p>\n

But web sites can make browser windows dance, popping up private information from other web sites you never intended to share. It can do this quickly and without your involvement. This becomes an active threat when you share your screen with a malicious site that is visible on that same screen. That site may now effectively browse as you, using any logged in credentials you may have in place, to target and steal your private data.<\/p>\n

Now that we have your attention, we can explain the extent of this risk, and how it came to be.<\/p>\n

Sharing a browser window does an end-run around the same-origin policy.<\/h3>\n

Web sites have always been able to make your web browser dance with content from lots of different places. Ads work this way in fact. But web sites normally can’t see the results of such cross-origin output themselves. That is: They can’t read back and interpret the pixels from other sites. These pixels were shown only on your screen, and that makes it safe. The technical term for this is the same-origin policy<\/a>. It’s an important web security mechanism that exists in all browsers.<\/p>\n

However, once you share a browser window with a site, you’re effectively giving that site a mirror. That site may now potentially see the results of other sites it summons, things it shouldn’t see. You no longer have that important web security mechanism in place.<\/p>\n

\n
Embed from Getty Images<\/a><\/div>\n